Commit 8dc0a5e7 authored by Kevin Wolf's avatar Kevin Wolf
Browse files

qcow2: Fix error handling in qcow2_alloc_cluster_offset 



If do_alloc_cluster_offset() fails, the error handling code tried to
remove the request from the in-flight queue, to which it wasn't added
yet, resulting in a NULL pointer dereference.

m->nb_clusters really only becomes != 0 when the request is in the list.

Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent e82dabd8

block/qcow2-cluster.c

+1 −1
Original line number Diff line number Diff line
@@ -931,7 +931,7 @@ again: 
fail:

    qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table);

fail_put:

    if (nb_clusters > 0) {

    if (m->nb_clusters > 0) {

        QLIST_REMOVE(m, next_in_flight);

    }

    return ret;